Privacy policy

1. Data controller

The controller of personal data is:

For matters related to personal data, you can contact us at the e-mail address shown above.

2. What data we process

Depending on how the website is used, we may process the following data:

• data provided when placing an order, in particular first and last name, delivery address, e-mail address, phone number, and details of the selected delivery and payment methods;
• order data, in particular ordered products, number of copies, price, delivery cost, order status, and the history of actions related to order handling;
• data provided during communication, if a visitor or buyer contacts us by e-mail, phone, or another channel;
• technical data related to use of the website, to the extent needed for its proper operation, security, and order handling.

If a buyer requests an invoice or acts as a business customer, we may also process data needed to issue or handle accounting documents, in particular company name, Polish tax ID (NIP), and address.

We may also process anonymous statistical data about website use, such as the number of visits, page views, and basic information about the website’s performance, collected using Cloudflare Web Analytics.

To diagnose technical errors and ensure the proper functioning of the website, we may use Sentry, a tool that records information about application errors and the basic technical context in which they occur, such as the address of the page on which the error occurred, information about the browser and device, and technical details concerning the operation of the application at the time of the error. These data are not used for profiling, advertising, or remarketing.

3. Purposes and legal bases of processing

We process personal data for the following purposes:

Order handling

We process order data to accept the order, handle payment, prepare the shipment, pass it to the carrier, and contact the buyer about the order.

The legal basis is Article 6(1)(b) GDPR, meaning processing necessary to enter into or perform a contract.

Legal, tax, and accounting obligations

Some data may be processed to comply with legal obligations, in particular tax, accounting, and consumer-law obligations.

The legal basis is Article 6(1)(c) GDPR, meaning processing necessary to comply with a legal obligation to which the controller is subject.

Complaints, contract withdrawals, and claims

Data may be processed to handle contract withdrawals, complaints, returns, and to establish, pursue, or defend claims.

The legal basis is Article 6(1)(b) GDPR when the matter concerns performance of a contract, and Article 6(1)(f) GDPR, meaning the controller’s legitimate interest in protecting its rights.

Communication

If a visitor or buyer contacts us by e-mail, phone, or another channel, we process the data provided in that communication to respond and handle the matter the contact concerns.

The legal basis is Article 6(1)(f) GDPR, meaning the controller’s legitimate interest in conducting communication and handling related matters.

Security and proper operation of the website

Technical data may be processed to ensure the proper operation of the website, maintain security, prevent abuse, and diagnose technical issues.

The legal basis is Article 6(1)(f) GDPR, meaning the controller’s legitimate interest in maintaining a secure and properly functioning website.

4. Who we may share data with

Personal data is not sold or shared with other entities for marketing purposes.

Data may be transferred or entrusted to entities whose services we use to operate the website and shop, to the extent necessary for the purposes described above. This applies in particular to:

• providers of technical services, hosting, website maintenance, and database services, in particular Cloudflare;
• payment operators, if a given payment method is handled by an external operator;
• carriers and delivery service operators, to the extent necessary to deliver a shipment;
• accounting, tax, or legal service providers, if this is needed for settlements, compliance with legal obligations, or protection of the controller’s rights;
• authorized public authorities, if the obligation to provide data results from law.

5. How long we keep data

The storage period depends on the purpose of processing and on legal obligations or the need to secure claims. In particular:

• order-related data is stored for the time needed to complete the order, and then for the period needed to handle contract withdrawals, complaints, and possible claims;
• data related to tax or accounting obligations is stored for the period required by applicable law;
• data provided during communication is stored for the time needed to handle the matter, and then for the period in which claims may arise or be pursued;
• technical data is stored for the time needed to ensure proper website operation and security.

After the relevant storage periods expire, personal data is deleted or anonymized so that it can no longer be assigned to a specific person. Data that no longer constitutes personal data may continue to be used for statistical and organizational purposes.

6. Right to erasure

A data subject may request erasure of personal data in the cases provided for by the GDPR. This right is not absolute.

We may refuse to erase data or erase it only partly if further processing is necessary to comply with a legal obligation, handle an unresolved matter, or establish, pursue, or defend claims.

A request to erase data does not mean waiver of consumer rights, in particular the right to make a complaint. It may, however, mean that some data will be deleted and some will be retained for the period required or legally justified.

7. Data subject rights

Data subjects have the rights set out in the GDPR, in particular:

• the right of access to data;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability, where applicable;
• the right to object to processing based on the controller’s legitimate interest;
• the right to lodge a complaint with the President of the Polish Personal Data Protection Office.

To exercise these rights, you can contact the controller at the e-mail address shown in the “Data controller” section.

8. Cookies, localStorage, and sessionStorage

The website uses necessary mechanisms for storing information in the visitor’s browser, such as cookies, localStorage, and sessionStorage.

These mechanisms support the proper operation of the website, in particular:

• remembering the selected website language;
• handling the order process;
• remembering data needed to move between order steps;
• ensuring proper operation of the interface.

The website does not use analytics or advertising cookies. We do not profile visitors for advertising or remarketing. We also do not run a newsletter or send marketing information requiring separate consent.

A visitor may restrict or delete data stored in the browser using browser settings. Restricting some mechanisms may affect website operation or prevent an order from being placed properly.

9. Voluntary provision of data

Providing data needed to place and handle an order is voluntary, but necessary to enter into and perform a sales contract.

Failure to provide data required in the order form may prevent an order from being placed or completed.

10. Transfers outside the European Economic Area

As a rule, we try to use technical solutions configured for the European Union area, especially for storing order data.

Some technical services may, however, involve access to data by entities operating outside the European Economic Area if this follows from how a given service is provided. In that case, data is transferred in accordance with GDPR mechanisms, in particular on the basis of appropriate legal safeguards used by service providers.

11. Changes to this Privacy Policy

This Privacy Policy may be updated, in particular if the website, shop, technical tools, or legal requirements change.

The current version of the Privacy Policy is available on the “Privacy Policy” page in the oddm.plus shop.